Netty HTTP/3 codec 4.2.2.Final through 4.2.17.Final contains an HTTP request smuggling caused by improper handling of HTTP/1 CONNECT authority-form request-targets in HttpConversionUtil.toHttp3Headers, letting remote attackers bypass tunnel allow-lists and egress policies by sending malformed HTTP/3 CONNECT requests, exploit requires attacker to send crafted CONNECT requests with mismatched Host headers.
Upgrade to version 4.2.18.Final or later.
Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.
A CVE describes the software, not your exposure. Panop discovers whether you run the affected product, then tests whether an attacker can actually reach it.
